CVE-2025-5835 — Missing Authorization in Droip

Vendor	Product	Version range	Fixed in
droip	droip	<= 2.2.6	—
msrc	cbl2_libplist_2.1.0-4_on_cbl_mariner_2.0	—	—
themeum	droip	<= 2.2.0	—

GHSA

GHSA-h7f2-69qh-3xqc: The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis(

ghsa_unreviewed·2025-07-25

CVE-2025-5835 [HIGH] CWE-862 GHSA-h7f2-69qh-3xqc: The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis( The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.

Red Hat

kernel: Linux kernel (jffs2): Denial of Service via invalid pointer dereference

vendor_redhat·2025-07-10·CVSS 5.5

CVE-2025-38328 [MEDIUM] CWE-252 kernel: Linux kernel (jffs2): Denial of Service via invalid pointer dereference kernel: Linux kernel (jffs2): Denial of Service via invalid pointer dereference In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated. Handle that. The code is ready for propagating the error upwards. KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace: jffs2_mar

Microsoft

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

vendor_msrc·2017-03-14·CVSS 7.5

CVE-2017-5835 [HIGH] CWE-770 libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner mitre: mitre Customer

CVE-2025-5835: The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis()…

Affected

CVSS provenance